Update dependency @fedify/fedify to v1.3.5 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@fedify/fedify (source)	1.3.1 -> 1.3.5

---

Release Notes

dahlia/fedify (@​fedify/fedify)

v1.3.5

Compare Source

Released on January 21, 2025.

• Fixed a bug where CreateFederationOptions.allowPrivateAddress option had
  been ignored by the Context.lookupObject() method when it had taken
  a fediverse handle.

• The lookupWebFinger() function became to silently return null when
  it fails to fetch the WebFinger document due to accessing a private network
  address, instead of throwing a UrlError.

v1.3.4

Compare Source

Released on January 21, 2025.

• Fixed several security vulnerabilities of the lookupWebFinger() function.
  [[CVE-2025-23221]]

  • Fixed a security vulnerability where the lookupWebFinger() function
    had followed the infinite number of redirects, which could lead to
    a denial of service attack. Now it follows up to 5 redirects.

  • Fixed a security vulnerability where the lookupWebFinger() function
    had followed the redirects to other than the HTTP/HTTPS schemes, which
    could lead to a security breach. Now it follows only the same scheme
    as the original request.

  • Fixed a security vulnerability where the lookupWebFinger() function
    had followed the redirects to the private network addresses, which
    could lead to a SSRF attack. Now it follows only the public network
    addresses.

v1.3.3

Compare Source

Released on December 30, 2024.

• The fetchDocumentLoader() function now preloads the following JSON-LD
  context: https://gotosocial.org/ns.

v1.3.2

Compare Source

Released on December 18, 2024.

• Fixed the default document loader to handle the Link header with
  incorrect syntax. [[#​196]]

---

Configuration

📅 Schedule: Branch creation - "* * * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.